CVE-2026-101029

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-15

Assigner: Gitea Limited

Description

Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the address that was validated was not necessarily the address Git later connected to. A low-privileged user who can create migrations or mirrors could direct the server to internal services, reading from and writing to reachable internal Git or HTTP endpoints. Content from internal responses could additionally be disclosed through migration and mirror error messages.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-101029

EUVD

EUVD-2026-93909

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	to 28.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-367	The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.
CWE-209	The product generates an error message that includes sensitive information about its environment, users, or associated data.
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This vulnerability in Gitea allows a low-privileged user to bypass repository migration and pull mirror egress checks by exploiting DNS responses with multiple addresses. The validated address during setup may not match the one Git later connects to, enabling the user to redirect traffic to internal services. This could lead to unauthorized reading from or writing to internal Git or HTTP endpoints, and internal response content might be exposed through error messages.

Detection Guidance

This vulnerability involves DNS-based bypass of Gitea's repository migration and pull mirror egress checks. To detect it, monitor DNS responses for Gitea-related operations to verify if multiple IP addresses are returned for the same hostname. Check Gitea server logs for unexpected internal service connections during migrations or mirrors.

Impact Analysis

If you use Gitea for repository management, an attacker with low privileges could exploit this flaw to access internal services, steal sensitive data, or modify repositories without authorization. Internal Git or HTTP endpoints could be compromised, and error messages might leak confidential information.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection principles or HIPAA's security requirements. Organizations may face compliance violations, legal penalties, or reputational damage if internal data is exposed or altered due to this flaw.

Mitigation Strategies

Update Gitea to the latest version that patches this vulnerability. Review and restrict user permissions to prevent low-privileged users from creating migrations or mirrors. Monitor network traffic for unusual internal service connections.

Hi! I’m here to help you understand CVE-2026-101029. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70